> I'm not sure what you mean here. Roles should be assigned to groups just like > to any other principal like a user, A group is a kind of principal? I find that odd. Can a group be responsible for some actions? Can a group be responsible for some request? -- Steve Alexander